gozi_ifsb | 192ae21881fe7e948c5fffc3bc1f44f904a7136d3fd251062fa304648c8a7571 | Triage

Analysis

max time kernel
128s
max time network
130s
platform
windows7_x64
resource
win7v20210408
submitted
12-05-2021 00:36

Sharing

Report Analysis Logs

General

Target

3b56b7298c366a323d28658a455abf0d4e78fa197a43ce13bedab05f26901d34.dll
Size

821KB
MD5

50a299d1e92d9205e123404c8e05904d
SHA1

c188272ab757dbbf14e74781fc90fcefe4aeb615
SHA256

3b56b7298c366a323d28658a455abf0d4e78fa197a43ce13bedab05f26901d34
SHA512

ec30f36d70ddbb6ba4aaccb3342e0a0ffbd586d2784370500a94e33aa650d1c56d3712ffc3a9e15a0558194ce26d1b76d9f2a8953220684bef634e57f4579df1

Score

10^/10

gozi_ifsb 8877 banker trojan

Malware Config

Extracted

Family

gozi_ifsb

Botnet

8877

C2

outlook.com/login

gmail.com

worunekulo.club

horunekulo.website

Attributes

build
250196
dga_season
10
exe_type
loader
server_id
12

rsa_pubkey.base64

serpent.plain

Signatures

Gozi, Gozi IFSB
Gozi ISFB is a well-known and widely distributed banking trojan.
banker trojan gozi_ifsb

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 784 wrote to memory of 1636	784	rundll32.exe	rundll32.exe
PID 784 wrote to memory of 1636	784	rundll32.exe	rundll32.exe
PID 784 wrote to memory of 1636	784	rundll32.exe	rundll32.exe
PID 784 wrote to memory of 1636	784	rundll32.exe	rundll32.exe
PID 784 wrote to memory of 1636	784	rundll32.exe	rundll32.exe
PID 784 wrote to memory of 1636	784	rundll32.exe	rundll32.exe
PID 784 wrote to memory of 1636	784	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3b56b7298c366a323d28658a455abf0d4e78fa197a43ce13bedab05f26901d34.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:784

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3b56b7298c366a323d28658a455abf0d4e78fa197a43ce13bedab05f26901d34.dll,#1
2⤵
PID:1636

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1636-60-0x0000000000000000-mapping.dmp

Download
memory/1636-61-0x0000000075AA1000-0x0000000075AA3000-memory.dmp

Filesize
8KB

Download
memory/1636-62-0x00000000746C0000-0x00000000746CF000-memory.dmp

Filesize
60KB

Download
memory/1636-63-0x00000000746C0000-0x00000000747AF000-memory.dmp

Filesize
956KB

Download
memory/1636-64-0x0000000000180000-0x0000000000181000-memory.dmp

Filesize
4KB

Download